Add channel test providers for Email, Slack, Teams, and Webhook

- Implemented EmailChannelTestProvider to generate email preview payloads.
- Implemented SlackChannelTestProvider to create Slack message previews.
- Implemented TeamsChannelTestProvider for generating Teams Adaptive Card previews.
- Implemented WebhookChannelTestProvider to create webhook payloads.
- Added INotifyChannelTestProvider interface for channel-specific preview generation.
- Created ChannelTestPreviewContracts for request and response models.
- Developed NotifyChannelTestService to handle test send requests and generate previews.
- Added rate limit policies for test sends and delivery history.
- Implemented unit tests for service registration and binding.
- Updated project files to include necessary dependencies and configurations.

deploy/compose/README.md

@@ -9,6 +9,7 @@ These Compose bundles ship the minimum services required to exercise the scanner
 | `docker-compose.dev.yaml` | Edge/nightly stack tuned for laptops and iterative work. |
 | `docker-compose.stage.yaml` | Stable channel stack mirroring pre-production clusters. |
 | `docker-compose.airgap.yaml` | Stable stack with air-gapped defaults (no outbound hostnames). |
+| `docker-compose.mirror.yaml` | Managed mirror topology for `*.stella-ops.org` distribution (Concelier + Excititor + CDN gateway). |
 | `env/*.env.example` | Seed `.env` files that document required secrets and ports per profile. |
 
 ## Usage

deploy/compose/docker-compose.mirror.yaml

@@ -0,0 +1,152 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "mirror-managed"
+
+networks:
+  mirror:
+    driver: bridge
+
+volumes:
+  mongo-data:
+  minio-data:
+  concelier-jobs:
+  concelier-exports:
+  excititor-exports:
+  nginx-cache:
+
+services:
+  mongo:
+    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
+    command: ["mongod", "--bind_ip_all"]
+    restart: unless-stopped
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME:-stellaops_mirror}"
+      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD:-mirror-password}"
+    volumes:
+      - mongo-data:/data/db
+    networks:
+      - mirror
+    labels: *release-labels
+
+  minio:
+    image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+    command: ["server", "/data", "--console-address", ":9001"]
+    restart: unless-stopped
+    environment:
+      MINIO_ROOT_USER: "${MINIO_ROOT_USER:-stellaops-mirror}"
+      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:-mirror-minio-secret}"
+    volumes:
+      - minio-data:/data
+    networks:
+      - mirror
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:dafef3954eb4b837e2c424dd2d23e1e4d60fa83794840fac9cd3dea1d43bd085
+    restart: unless-stopped
+    depends_on:
+      - mongo
+      - minio
+    environment:
+      ASPNETCORE_URLS: "http://+:8445"
+      CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME:-stellaops_mirror}:${MONGO_INITDB_ROOT_PASSWORD:-mirror-password}@mongo:27017/concelier?authSource=admin"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://minio:9000"
+      CONCELIER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER:-stellaops-mirror}"
+      CONCELIER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD:-mirror-minio-secret}"
+      CONCELIER__TELEMETRY__SERVICENAME: "stellaops-concelier-mirror"
+      CONCELIER__MIRROR__ENABLED: "true"
+      CONCELIER__MIRROR__EXPORTROOT: "/exports/json"
+      CONCELIER__MIRROR__LATESTDIRECTORYNAME: "${CONCELIER_MIRROR_LATEST_SEGMENT:-latest}"
+      CONCELIER__MIRROR__MIRRORDIRECTORYNAME: "${CONCELIER_MIRROR_DIRECTORY_SEGMENT:-mirror}"
+      CONCELIER__MIRROR__REQUIREAUTHENTICATION: "${CONCELIER_MIRROR_REQUIRE_AUTH:-true}"
+      CONCELIER__MIRROR__MAXINDEXREQUESTSPERHOUR: "${CONCELIER_MIRROR_INDEX_BUDGET:-600}"
+      CONCELIER__MIRROR__DOMAINS__0__ID: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_ID:-primary}"
+      CONCELIER__MIRROR__DOMAINS__0__DISPLAYNAME: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_NAME:-Primary Mirror}"
+      CONCELIER__MIRROR__DOMAINS__0__REQUIREAUTHENTICATION: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_AUTH:-true}"
+      CONCELIER__MIRROR__DOMAINS__0__MAXDOWNLOADREQUESTSPERHOUR: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET:-3600}"
+      CONCELIER__MIRROR__DOMAINS__1__ID: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_ID:-community}"
+      CONCELIER__MIRROR__DOMAINS__1__DISPLAYNAME: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_NAME:-Community Mirror}"
+      CONCELIER__MIRROR__DOMAINS__1__REQUIREAUTHENTICATION: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_AUTH:-false}"
+      CONCELIER__MIRROR__DOMAINS__1__MAXDOWNLOADREQUESTSPERHOUR: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET:-1800}"
+      CONCELIER__AUTHORITY__ENABLED: "${CONCELIER_AUTHORITY_ENABLED:-true}"
+      CONCELIER__AUTHORITY__ALLOWANONYMOUSFALLBACK: "${CONCELIER_AUTHORITY_ALLOW_ANON:-false}"
+      CONCELIER__AUTHORITY__ISSUER: "${CONCELIER_AUTHORITY_ISSUER:-https://authority.stella-ops.org}"
+      CONCELIER__AUTHORITY__METADATAADDRESS: "${CONCELIER_AUTHORITY_METADATA:-}"
+      CONCELIER__AUTHORITY__CLIENTID: "${CONCELIER_AUTHORITY_CLIENT_ID:-stellaops-concelier-mirror}"
+      CONCELIER__AUTHORITY__CLIENTSECRETFILE: "/run/secrets/concelier-authority-client"
+      CONCELIER__AUTHORITY__CLIENTSCOPES__0: "${CONCELIER_AUTHORITY_SCOPE:-concelier.mirror.read}"
+      CONCELIER__AUTHORITY__AUDIENCES__0: "${CONCELIER_AUTHORITY_AUDIENCE:-api://concelier.mirror}"
+      CONCELIER__AUTHORITY__BYPASSNETWORKS__0: "10.0.0.0/8"
+      CONCELIER__AUTHORITY__BYPASSNETWORKS__1: "127.0.0.1/32"
+      CONCELIER__AUTHORITY__BYPASSNETWORKS__2: "::1/128"
+      CONCELIER__AUTHORITY__RESILIENCE__ENABLERETRIES: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__0: "00:00:01"
+      CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__1: "00:00:02"
+      CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__2: "00:00:05"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "00:10:00"
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+      - concelier-exports:/exports/json
+      - ./mirror-secrets:/run/secrets:ro
+    networks:
+      - mirror
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:d9bd5cadf1eab427447ce3df7302c30ded837239771cc6433b9befb895054285
+    restart: unless-stopped
+    depends_on:
+      - mongo
+    environment:
+      ASPNETCORE_URLS: "http://+:8448"
+      EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME:-stellaops_mirror}:${MONGO_INITDB_ROOT_PASSWORD:-mirror-password}@mongo:27017/excititor?authSource=admin"
+      EXCITITOR__STORAGE__MONGO__DATABASENAME: "${EXCITITOR_MONGO_DATABASE:-excititor}"
+      EXCITITOR__ARTIFACTS__FILESYSTEM__ROOT: "/exports"
+      EXCITITOR__ARTIFACTS__FILESYSTEM__OVERWRITEEXISTING: "${EXCITITOR_FILESYSTEM_OVERWRITE:-false}"
+      EXCITITOR__MIRROR__DOMAINS__0__ID: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_ID:-primary}"
+      EXCITITOR__MIRROR__DOMAINS__0__DISPLAYNAME: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_NAME:-Primary Mirror}"
+      EXCITITOR__MIRROR__DOMAINS__0__REQUIREAUTHENTICATION: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_AUTH:-true}"
+      EXCITITOR__MIRROR__DOMAINS__0__MAXINDEXREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_INDEX_BUDGET:-300}"
+      EXCITITOR__MIRROR__DOMAINS__0__MAXDOWNLOADREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET:-2400}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__KEY: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_KEY:-consensus-json}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__FORMAT: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_FORMAT:-json}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__VIEW: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_VIEW:-consensus}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__KEY: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_KEY:-consensus-openvex}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__FORMAT: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_FORMAT:-openvex}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__VIEW: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_VIEW:-consensus}"
+      EXCITITOR__MIRROR__DOMAINS__1__ID: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_ID:-community}"
+      EXCITITOR__MIRROR__DOMAINS__1__DISPLAYNAME: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_NAME:-Community Mirror}"
+      EXCITITOR__MIRROR__DOMAINS__1__REQUIREAUTHENTICATION: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_AUTH:-false}"
+      EXCITITOR__MIRROR__DOMAINS__1__MAXINDEXREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_INDEX_BUDGET:-120}"
+      EXCITITOR__MIRROR__DOMAINS__1__MAXDOWNLOADREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET:-600}"
+      EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__KEY: "${EXCITITOR_MIRROR_SECONDARY_EXPORT_KEY:-community-consensus}"
+      EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__FORMAT: "${EXCITITOR_MIRROR_SECONDARY_EXPORT_FORMAT:-json}"
+      EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__VIEW: "${EXCITITOR_MIRROR_SECONDARY_EXPORT_VIEW:-consensus}"
+    volumes:
+      - excititor-exports:/exports
+      - ./mirror-secrets:/run/secrets:ro
+    expose:
+      - "8448"
+    networks:
+      - mirror
+    labels: *release-labels
+
+  mirror-gateway:
+    image: docker.io/library/nginx@sha256:208b70eefac13ee9be00e486f79c695b15cef861c680527171a27d253d834be9
+    restart: unless-stopped
+    depends_on:
+      - concelier
+      - excititor
+    ports:
+      - "${MIRROR_GATEWAY_HTTP_PORT:-8080}:80"
+      - "${MIRROR_GATEWAY_HTTPS_PORT:-9443}:443"
+    volumes:
+      - nginx-cache:/var/cache/nginx
+      - ./mirror-gateway/conf.d:/etc/nginx/conf.d:ro
+      - ./mirror-gateway/tls:/etc/nginx/tls:ro
+      - ./mirror-gateway/secrets:/etc/nginx/secrets:ro
+    networks:
+      - mirror
+    labels: *release-labels

deploy/compose/env/mirror.env.example

@@ -0,0 +1,57 @@
+# Managed mirror profile substitutions
+
+# Core infrastructure credentials
+MONGO_INITDB_ROOT_USERNAME=stellaops_mirror
+MONGO_INITDB_ROOT_PASSWORD=mirror-password
+MINIO_ROOT_USER=stellaops-mirror
+MINIO_ROOT_PASSWORD=mirror-minio-secret
+
+# Mirror HTTP listeners
+MIRROR_GATEWAY_HTTP_PORT=8080
+MIRROR_GATEWAY_HTTPS_PORT=9443
+
+# Concelier mirror configuration
+CONCELIER_MIRROR_LATEST_SEGMENT=latest
+CONCELIER_MIRROR_DIRECTORY_SEGMENT=mirror
+CONCELIER_MIRROR_REQUIRE_AUTH=true
+CONCELIER_MIRROR_INDEX_BUDGET=600
+CONCELIER_MIRROR_DOMAIN_PRIMARY_ID=primary
+CONCELIER_MIRROR_DOMAIN_PRIMARY_NAME=Primary Mirror
+CONCELIER_MIRROR_DOMAIN_PRIMARY_AUTH=true
+CONCELIER_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET=3600
+CONCELIER_MIRROR_DOMAIN_SECONDARY_ID=community
+CONCELIER_MIRROR_DOMAIN_SECONDARY_NAME=Community Mirror
+CONCELIER_MIRROR_DOMAIN_SECONDARY_AUTH=false
+CONCELIER_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET=1800
+
+# Authority integration (tokens issued by production Authority)
+CONCELIER_AUTHORITY_ENABLED=true
+CONCELIER_AUTHORITY_ALLOW_ANON=false
+CONCELIER_AUTHORITY_ISSUER=https://authority.stella-ops.org
+CONCELIER_AUTHORITY_METADATA=
+CONCELIER_AUTHORITY_CLIENT_ID=stellaops-concelier-mirror
+CONCELIER_AUTHORITY_SCOPE=concelier.mirror.read
+CONCELIER_AUTHORITY_AUDIENCE=api://concelier.mirror
+
+# Excititor mirror configuration
+EXCITITOR_MONGO_DATABASE=excititor
+EXCITITOR_FILESYSTEM_OVERWRITE=false
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_ID=primary
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_NAME=Primary Mirror
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_AUTH=true
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_INDEX_BUDGET=300
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET=2400
+EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_KEY=consensus-json
+EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_FORMAT=json
+EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_VIEW=consensus
+EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_KEY=consensus-openvex
+EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_FORMAT=openvex
+EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_VIEW=consensus
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_ID=community
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_NAME=Community Mirror
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_AUTH=false
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_INDEX_BUDGET=120
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET=600
+EXCITITOR_MIRROR_SECONDARY_EXPORT_KEY=community-consensus
+EXCITITOR_MIRROR_SECONDARY_EXPORT_FORMAT=json
+EXCITITOR_MIRROR_SECONDARY_EXPORT_VIEW=consensus

deploy/compose/mirror-gateway/README.md

@@ -0,0 +1,13 @@
+# Mirror Gateway Assets
+
+This directory holds the reverse-proxy configuration and TLS material for the managed
+mirror profile:
+
+- `conf.d/*.conf` – nginx configuration shipped with the profile.
+- `tls/` – place environment-specific certificates and private keys
+  (`mirror-primary.{crt,key}`, `mirror-community.{crt,key}`, etc.).
+- `secrets/` – populate Basic Auth credential stores (`*.htpasswd`) that gate each
+  mirror domain. Generate with `htpasswd -B`.
+
+The Compose bundle mounts these paths read-only. Populate `tls/` with the actual
+certificates before invoking `docker compose config` or `docker compose up`.

deploy/compose/mirror-gateway/conf.d/mirror-locations.conf

@@ -0,0 +1,44 @@
+proxy_set_header Host              $host;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_redirect                     off;
+
+add_header X-Cache-Status $upstream_cache_status always;
+
+location = /healthz {
+    default_type application/json;
+    return 200 '{"status":"ok"}';
+}
+
+location /concelier/exports/ {
+    proxy_pass http://concelier_backend/concelier/exports/;
+    proxy_cache mirror_cache;
+    proxy_cache_key $mirror_cache_key;
+    proxy_cache_valid 200 5m;
+    proxy_cache_valid 404 1m;
+    add_header Cache-Control "public, max-age=300, immutable" always;
+}
+
+location /concelier/ {
+    proxy_pass http://concelier_backend/concelier/;
+    proxy_cache off;
+}
+
+location /excititor/mirror/ {
+    proxy_pass http://excititor_backend/excititor/mirror/;
+    proxy_cache mirror_cache;
+    proxy_cache_key $mirror_cache_key;
+    proxy_cache_valid 200 5m;
+    proxy_cache_valid 404 1m;
+    add_header Cache-Control "public, max-age=300, immutable" always;
+}
+
+location /excititor/ {
+    proxy_pass http://excititor_backend/excititor/;
+    proxy_cache off;
+}
+
+location / {
+    return 404;
+}

deploy/compose/mirror-gateway/conf.d/mirror.conf

@@ -0,0 +1,51 @@
+proxy_cache_path /var/cache/nginx/mirror levels=1:2 keys_zone=mirror_cache:100m max_size=10g inactive=12h use_temp_path=off;
+
+map $request_uri $mirror_cache_key {
+    default $scheme$request_method$host$request_uri;
+}
+
+upstream concelier_backend {
+    server concelier:8445;
+    keepalive 32;
+}
+
+upstream excititor_backend {
+    server excititor:8448;
+    keepalive 32;
+}
+
+server {
+    listen 80;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mirror-primary.stella-ops.org;
+
+    ssl_certificate     /etc/nginx/tls/mirror-primary.crt;
+    ssl_certificate_key /etc/nginx/tls/mirror-primary.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    auth_basic "StellaOps Mirror – primary";
+    auth_basic_user_file /etc/nginx/secrets/mirror-primary.htpasswd;
+
+    include /etc/nginx/conf.d/mirror-locations.conf;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mirror-community.stella-ops.org;
+
+    ssl_certificate     /etc/nginx/tls/mirror-community.crt;
+    ssl_certificate_key /etc/nginx/tls/mirror-community.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    auth_basic "StellaOps Mirror – community";
+    auth_basic_user_file /etc/nginx/secrets/mirror-community.htpasswd;
+
+    include /etc/nginx/conf.d/mirror-locations.conf;
+}